Decline Code

Decline codes are defined in card network and ISO 8583 specifications. The issuer returns a response code in field 39 of the ISO 8583 authorisation response message. This code is translated by the gateway or processor into a human-readable decline category and surfaced to the merchant.

Decline codes fall into two primary categories: soft declines and hard declines. Soft declines indicate a temporary condition that may resolve on retry or with additional authentication. Common soft decline codes include 05 (do not honor), 51 (insufficient funds), 65 (transaction not permitted to cardholder), and specific SCA-related soft declines that indicate authentication is required. Hard declines indicate a permanent condition that should not be retried. Hard decline codes include 41 (lost card), 43 (stolen card), 04 (pick up card), and 62 (restricted card).

The distinction between soft and hard declines is critical for retry logic. Card scheme rules explicitly prohibit retrying hard declines; a merchant who retries a stolen card decline is violating scheme rules and risks fines. Soft declines may be retried within specific scheme-mandated windows and frequency limits.

Issuers also return acquirer-specific and network-specific decline codes that do not appear in the base ISO 8583 specification. These proprietary codes require interpretation using network-specific documentation and may carry additional information about the reason for the decline.

Decline code granularity determines the quality of diagnostic insight: summary-level decline reporting (approved vs. declined) is useless for optimisation. Granular decline code data broken down by card type, acquirer, and geography reveals where specific interventions will have impact.

Soft vs. hard decline classification must be enforced in retry logic: retry systems that treat all declines the same risk violating scheme rules on hard declines while also failing to recover soft declines optimally. Every retry decision should check the decline code classification before submitting a retry attempt.

Scheme rules govern retry timing and frequency for soft declines: card networks mandate specific waiting periods and maximum retry counts for different soft decline codes. Violating these restrictions generates scheme fines that can accumulate rapidly for high-volume merchants with automated retry logic.

Decline code patterns reveal attack signals: a sudden spike in specific decline codes, such as a concentration of invalid card number responses (code 14) in a short period, is a signature of card testing or BIN attack activity. Monitoring decline code distribution in real time is part of fraud detection.